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This paper summarizes the application of a nonlinear dynamic inversion (DI) flight control system (FCS) 
to an autonomous flight test vehicle in NASA’s X-38 Project, a predecessor to the International Space 
Station (ISS) Crew Return Vehicle (CRV). Honeywell’s Multi-Application Control-H (MACH) is a 
parameterized FCS design architecture including both model-based DI rate-compensation and classical P+I 
command-tracking. MACH was adopted by X-38 in order to shorten the design cycle time for different 
vehicle shapes and flight envelopes and evolving aerodynamic databases. Specific design issues and 
analysis results are presented for the application of MACH to the 3 rd free flight (FF3) of X-38 Vehicle 132 
(VI32). This B-52 drop test, occurring on March 30, 2000, represents the first flight test of MACH and 
one of the first few known applications of DI in the primary FCS of an autonomous flight test vehicle. 
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ABSTRACT 


This paper summarizes the application of a nonlinear dynamic inversion (DI) flight control system (FCS) 
to an autonomous flight test vehicle in NASA’s X-38 Project, a predecessor to the International Space 
Station (ISS) Crew Return Vehicle (CRV). Honeywell’s Multi-Application Control-H (MACH) is a 
parameterized FCS design architecture including both model-based DI rate-compensation and classical P+I 
command-tracking. MACH was adopted by X-38 in order to shorten the design cycle time for different 
vehicle shapes and flight envelopes and evolving aerodynamic databases. Specific design issues and 
analysis results are presented for the application of MACH to the 3 rd free flight (FF3) of X-38 Vehicle 132 
(VI32). This B-52 drop test, occurring on March 30, 2000, represents the first flight test of MACH and 
one of the first few known applications of DI in the primary FCS of an autonomous flight test vehicle. 


INTRODUCTION 


X-38 Mission Overview and Requirements 

The NASA Johnson Space Center (JSC) X-38 Project is a technology demonstrator and prototype for the 
CRV, a “lifeboat” for ISS. The CRV will be capable of returning an injured or incapacitated astronaut to 
earth in a medical emergency, or all seven ISS crew members during an evacuation. The CRV could be 
modified for other uses, such as a general crew transport vehicle launched atop an Ariane 5 booster. It will 
become the first new human spacecraft to travel to and from orbit in the past two decades, developed at a 
fraction of the cost of past manned space vehicles. The reduced development cost and accelerated schedule 
made the X-38 Project attractive given current NASA budgetary constraints and ISS CRV requirements. 

The X-38 Project includes multiple lifting body aircraft based largely upon airframes tested by the U.S. Air 
Force in the 1960s. X-38 flight testing began with subsonic vehicles air-launched from the starboard wing 
of a B-52 bomber at NASA’s Dryden Flight Research Center (DFRC), and will culminate in a space 
vehicle which will be deployed from a Shuttle cargo bay for a full deorbit, entry and landing test. Vehicle 
131 (V131) was uncontrolled, used to test the aerodynamics and parachute and landing systems. VI32 was 
the first X-38 test vehicle with an autonomous FCS. The first two free flights (FF1 and FF2) of VI32 
used a classical derivation of the Shuttle entry FCS. This report focuses upon VI32 FF3, which employed 
MACH, a Honeywell implementation of DI. 


Technical Issues Raised 

X-38 drop tests present many challenges for FCS design. X-38 lifting bodies have inherently coupled, 
nonlinear dynamics and reduced controllability and stability relative to traditional aircraft. The B-52 
bomber used as a drop test carrier aircraft imparts strong, transient aerodynamic moments upon the test 
vehicle during the first couple of seconds following release. The fact that FF3 was the fastest and highest 
of the three VI32 flight tests only magnified this B-52 transient as a design issue. MACH’s computational 
requirements had to fit in the FCS budget on the VI32 flight computer. The nonlinear MACH controller 
had to be linearized in order to apply linear stability analyses and verify stability margin requirements were 
being met across the range of large aerodynamic uncertainties. An estimate of sideslip angle was necessary 
to meet MACH’s full-state feedback requirement. 
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MACH OVERVIEW 


MACH is a blended implementation of classical and modem controllers. Classical proportional + integral 
(P+I) outer loops provide attitude angle command tracking, while DI inner loops provide rate 
compensation. 


Applications 


MACH is a decade old, but had not reached the flight test stage before X-38. VI32 FF3 represented the 
first flight test of MACH, and, the authors believe, one of the first few flight tests of a primary 
autonomous FCS using DI as a central design technique. 


Program/Vehicle 

Years 

Current Maturity 

F-18 High Angle-of-attack Research Vehicle (HARV) 

1991-1995 

HW-in-the-loop sim. 

Joint Defense Attack Munition (JDAM) 

1992 

Engineering sim. 

DC-X, high-AOA atmospheric maneuvering 

1993 

Engineering sim. 

F-117, USAF Multivariable Control Design Guidelines 

1993-1996 

Engineering sim. 

YF-22, USAF Multivariable Control Design Guidelines 

1993-1996 

Engineering sim. 

MCT/F-16, USAF Multivariable Control Design Guidelines 

1993-1996 

Engineering sim. 

Lockheed-Margin Joint Strike Fighter (JSF), Marine STOVL 

1995-1999 

Piloted sim. 

X-38 V132 FF3 

1996-1999 

Flight test 

X-38 V131R 

1999-2001 

Flight test 

X-38 V201 

1998-2002 

Engineering sim. 


Table 1: History of MACH Applications 


Dynamic Inversion 

DI is a multivariable, nonlinear, model-based controller design technique. The idea is not new, proposed 
for FCS applications as early as 1975 by Meyer and Cicolani (NASA TN D-7940). However, considerable 
computational requirements made DI FCS applications impractical until the last decade. 

DI Basics 

1. Compute a model of the vehicle’s nonlinear dynamics in real time during flight. 

2. Dynamically invert this model to cancel expected nonlinear dynamics. 

3. Insert desired vehicle response dynamics, which are typically linear and 1 st order, e.g., k / (s + k). 

Disadvantages of DI and MACH 

1. It can be computationally intensive for a flight computer to compute and invert a nonlinear vehicle 
model in real time. This is largely the reason MACH has not flown before X-38. Several 
streamlining modifications were made to MACH in order for its computational requirements to fit 
within the FCS timing allotment on the VI32 flight computer. 

2. The on-board model of vehicle dynamics requires full-state feedback. So, vehicle states must be 
measured by a full complement of sensors, and those states that are not measured must be 
estimated, e.g., sideslip angle. 

3. DI can be complex to implement in software. The general version of MACH has added complexity 
due to its “multi-application” feature, which in part means it is automatically scalable for different 
numbers and types of control effectors and states. The computational speed enhancements 
mentioned above included stripping out some of this general functionality and customizing 
MACH specifically for VI32. 
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Advantages of DI and MACH 

1. Preliminary FCS designs for various, similar vehicles may be realized simply by swapping out 
the on-board model of vehicle dynamics, keeping the overall architecture largely unchanged. 
MACH’s generality of application was well suited to the X-38 Project, which required FCS 
designs for multiple, similar vehicles in a tight schedule. 

2. The DI portion of MACH reduces or even eliminates the need for point design gain scheduling. 
Traditional FCS design techniques, involve tailoring a series of point designs to the vehicle- 
specific aerodynamics at pre-selected flight conditions along a trajectory or within a flight 
envelope, then linearly scheduling gains between these points. DI may be described simply as 
automatic, real-time, nonlinear gain scheduling, based upon the same vehicle aerodynamics 
database used to tune traditional point designs. So, for the X-38 test vehicles, there is no gain 
scheduling in the traditional sense, though MACH’s controlled variable structure and outer loop 
gains must be tuned for each subsonic vehicle, and for each control mode of the entry vehicle, 
e.g., blended jets and aerodynamic effectors, no rudder during high heating, etc. 

3. DI compensates for any nonlinear, coupled dynamics included in the on-board computational 
model of the vehicle. X-38 lifting bodies have some nonlinear aerodynamics, e.g., yawing 
moment as a function of sideslip angle, and have much more highly coupled longitudinal and 
lateral-directional dynamics than traditional, winged aircraft. 


Architecture 


MACH’s overall structure (Figure I) includes concepts ranging from convt 
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Figure 1: MACH Architecture 
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There are five main ingredients in MACH: 


1. Controlled Variables (CV) are selected for performance (command tracking and disturbance 
rejection) and robustness. They must offer stable zero dynamics, as inverted zeros become poles in 
DI. CV definitions may blend rotational and translational control, and provide coordinated flight 
in a steady wind. VI32 MACH uses three CVs, LCV, MCV and NCV for roll, pitch and yaw 
axes, respectively. 

2. Outer loops convert guidance commands into CV commands (Figure 2), and include trim 
integrators to protect for vehicle modeling errors. In VI32 MACH, LCV cmd depends upon the 
bank angle command, MCV cm d depends upon the commanded angle of attack (a), and NCV cm d is 
zero, indicating a desire for zero sideslip angle (p). 
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Figure 2: MAC FI Outer Loops 

3. Desired dynamics are defined by P+I elements, and may be described by a I st order transfer 
function, assuming perfect DI reduces all inner loop dynamics to a simple integrator, 1/s. 



Figure 3: MACH Desired Dynamics 

4. Control allocation optimally divides control authority between effectors when shared surfaces are 
on rate or position limits, based upon preset axis priority weighting, e.g., NCV/LCV = 5 implies 
NCV control is five times as important as LCV. 

5. The On-Board Aircraft Model (OBAC) computes the nonlinear vehicle dynamics on the flight 
computer. In the interest of real-time computational efficiency, a least-squares (LSQ) method was 
used to approximate the full VI32 aerodynamics database. The result was a compact, fast LSQ 
aerodynamics model containing only 175 values at a constant mach number of 0.6 and trim 
elevon deflection of 30°, nonlinear with respect to a but linear with respect to angular rates (p, q, 
r) and aerosurface deflections, aileron, elevon and rudder (d a , d e , d T ). 
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VEHICLE DESCRIPTION 


X-38 Vehicles 

X-38 airframes evolved from the X-24 wingless lifting body test vehicles of the late 1960s. The first two 
X-38 subsonic test vehicles, V131 and VI32, closely resembled the X-24A shape, which enabled existing 
X-24A aerodynamics data to reduce the need for early X-38 wind tunnel testing. The planned space flight 
test vehicle, V201, and its sub-scale atmospheric equivalent, V131R, expand the V131 /132 shape to 
provide the additional space necessary for seven ISS crew members, two drogue chutes and a larger main 
parafoil. X-38 vehicles have four aerodynamic control surfaces, two rudders and two body flaps. Rudder 
deflection (3 r ) provides roll and yaw control. Though not used for VI32, the rudders also may be moved in 
opposite directions for “speed brake” deflection, which can be used to augment pitch trim. Moved in the 
same direction, the two body flaps provide elevon deflection ( d e ) for pitch control, and when moved in 
opposite directions they provide aileron deflection (d a ) for limited roll control. The subsonic test vehicles 
are single string systems, while the V201 space test vehicle will have multiple redundancy. 



Figure 4: VI31/132 Figure 5: V131R/201 


Vehicle 

V131 

V132 

V131R 

V201 

Primary FCS 

None 

FF1&2: Classical, FF3: MACH 

MACH 

MACH 

Mass (lbs) 

14000 

18000 

25000 

Main Structure 

Fiberglass 

Fiberglass 

Aluminum 

Length (in) 

283 

283 

340 

Width (in) 

120 

120 

144 

Xcg (% Ref. Length) 

57.1 

59.2 

59.0 

Reference Length (ft) 

23.0 

23.0 

27.6 


Table 2: X-38 Vehicle Properties 


VI32 GN&C Subsystems 

The VI32 MACH FCS ran at 25 Hz on a Motorola 68040 processor running at 25MHz. The MACH flight 
software was a subset of the VI32 GN&C executive software that interfaced with the avionics systems. 

VI32 “guidance” was simply a pre-programmed, time-based, open-loop angle-of-attack command profile 
and a constant bank angle command of zero overlayed with time-based Programmed Test Input (PTI) 
commands used for post-flight aerodynamic extraction. A Honeywell Embedded GPS/INS (EGI) box 
provided attitude, rate, and acceleration data. A Flush Air Data System (FADS) located in the vehicle nose 
cap used differential port pressure measurements to provide relative velocity, a, P, dynamic pressure, and 
mach number. The four aerodynamic control surfaces were each moved by a single electro-mechanical 
actuator (EMA). 
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VI32 Vehicle Safety 

Although VI32 systems were “single string,” i.e., no redundancy, many GN&C systems could “safe” the 
vehicle if a problem developed. VI32 software could initiate early flight termination and drogue 
deployment if attitude rates or dynamic pressure exceeded predetermined limits. A FADS failure was 
handled by switching to a backup Navigation Air Data (NAVDAD) algorithm to provide EGI-derived 
estimates of vehicle relative velocity, a, (3, dynamic pressure, and mach number. Communication faults 
and computational errors were monitored and, if persistent, could result in early flight termination. In the 
event of a total failure of the flight computer, drogue chute or parafoil, a backup chute could be deployed 
from the ground. Finally, the vehicle had a completely independent flight termination system triggered by 
a range safety officer if the vehicle strayed outside of its range boundary. 

VI32 Subsonic Aerodynamics and Uncertainties 

Lifting bodies provide significant challenges to FCS design. Short moment arms result in limited control 
authority and sluggish vehicle response, especially in roll. In fact, V132 rudders were three times more 
effective in roll than the ailerons, which exemplifies the coupled nature of VI32 control. The blunt aft end 
induces asymmetric base flow which imparts yaw and roll moments upon the vehicle, as observed during 
VI32 flight tests. Fortunately, these asymmetries were within the uncertainties of the VI32 aerodynamic 
database used for FCS design. Base flow effects also degraded aileron effectiveness. 


Vector diagrams showing the contributions of effectors and attitude angles upon moment coefficients were 
used to assess stability and controllability. Figure 6 contains rudder (left), aileron and (3 (right) vectors 
plotted on C\ vs. C n axes. Uncertainty boxes drawn around each vector were used to determine worst case 
uncertainty combinations for FCS testing. Wide separation of vectors is desirable for controllability. An 
ideal aircraft might have a nearly horizontal rudder vector and a longer, nearly vertical aileron vector, i.e., 
pure roll and yaw axis controllers. Uncertainties or flight conditions which align the effector vectors result 
in loss of effector independence—redundant effectors—and degraded controllability. Directional stability is 
reduced as the (3 vector moves left. [3 vector separation is required for bank angle controllability. 


Beta, Aileron, and Rudder Vectors at Mach 0.5, Alpha * 12. Vehicle 132 Nominal Aero with Uncertainty 

Boxes. 
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Figure 6: VI32 Lateral-Directional Vector Diagram, M= 0.5, a= 12° 

Figure 6 shows the VI32 vector diagram at M = 0.5 and a = 12°. The relatively small aileron vector 
indicates the low effectiveness of the aileron compared to the rudder. The nominal aileron and rudder 
vectors are reasonably separated, but there are clearly points on the uncertainty boxes which align the two 
vectors, so the FCS had to be robust to this alignment case. The aileron and rudder vectors became more 
closely aligned near M = 1. However, the highest, fastest VI32 drop test, FF3, began at M = 0.6. 
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Lateral control departure parameters (LCDP) [1] for each effector are measures of bank control and numeric 
indicators of effector/p vector alignment. The following equations define aileron and rudder LCDP in terms 
of stability derivatives, and provide inequality criteria for proverse bank angle control. 

Aileron: LCDP\ = C n C, - C, C > 0 

da tip 1 &I Ip n &l 

Rudder: LCDP S = C C, — C, C < 0 

dr n p l 5r l p n 5r 

LCDP = 0 indicates effector/p vector alignment and neutral bank control, i.e., any control deflection is 
offset by P, resulting in zero roll. An adverse LCDP, i.e., reversal of either of the above inequalities, 
indicates reversal of the corresponding effector’s bank control authority. For example, while positive 
aileron deflection normally results in positive roll, a negative aileron LCDP means that positive aileron 
combines with P to create negative roll—this is called “aileron reversal.” 
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VI32 MACH DESIGN 


This section describes the control system design modifications developed to address the unique issues 
associated with the 132 vehicle and flight test. Within the structure of the existing MACH architecture, 
bandwidth and CV selections were made to satisfy mission, flying qualities and stability margin 
requirements as stated in the previous section of this paper. Generally, this involved an iterative approach 
of gain selections tested in linear and nonlinear simulation. In addition, new algorithm changes evolved to 
handle uncertain aerodynamics, the lack of a sideslip measurement and the large but short disturbance from 
B52 release. More in-depth discussion of these may be found in references 1-3. 

CV Selection 


With good separation in elevon, aileron and rudder effectiveness for the anticipated flight near a = 12°, 
three CVs—LCV, MCV, and NCV—were chosen to independently control the three rotational axes—roll, 
pitch and yaw, respectively. The CVs definitions evolved from previous experience with classical flight 
control systems and other MACH applications (Table 1), using EGI body attitude, inertial rates, 
translational accelerations, and FADS measurements of a, velocity and dynamic pressure: 


LCV = p s 
MCV=q+ 
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These were chosen to stabilize zero dynamics, complement a and <|> command tracking, and maintain 
coordinated flight in a steady wind. In NCV, a complementary filter approach (Figure 7) blended low- 
frequency lateral acceleration (n y ) with high-frequency estimated (3 (p es t) to form an equivalent (3 ((3 eqU iv) 
which would maintain zero sideslip in steady-state flight. The filter had a bandwidth of 0.5 rad/sec, near 
the controller bandwidth, and was inverted as part of the OBAC. 

Post 



Figure 7: NCV Filtered Sideslip Angle 


Loop Design 

Inner loop P+I compensation bandwidths were set to 1.0 rad/sec for LCV and NCV and 1.7 rad/sec for 
MCV by setting the K B design parameter to 2 and 3.4, respectively (see Figure 3). Anti-windup logic was 
employed to prevent integrator build-up during periods of surface saturation. 

The outer loops turn a and (j> commands into MCV and LCV commands, respectively (Figure 2). Outer 
loop gains, b 0 = 0.4 and b a = 1.0, were based upon performance requirements and inner loop bandwidths. 
Note that angle-of-attack rate is computed in the OBAC and not sensed. 
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Beta Estimation 


In general, MACH requires full-state feedback, and therefore requires a sideslip angle sensor for OBAC 
computations. Because FADS-computed sideslip angle was not available for feedback use on VI32, four 
(3 estimation options were investigated: (1) special cases of Kalman filters, (2) inertial sideslip, (3) sideslip 
derived from lateral acceleration, and (4) zero sideslip. Option 1 was eliminated early because it was 
oversimplified and never tuned properly. Option 2 was unacceptable in steady winds where it is 
destabilizing at low frequencies. Option 3 led to poor stability margins. Option 4 ultimately was chosen. 

Further rationale for option 4 came from a stability margin analysis for a typical flight condition and 
dynamic pressure. The analysis considered a low-passed measurement of sideslip angle as the control law 
sensor. The low pass filter break frequency was varied between 0 and 100 rad/sec. The best phase and gain 
margins were achieved for low break frequencies (Figure 8). In fact, approximating sideslip as zero gave the 
best robust stability. Also, the minimum closed-loop damping ratio is only slightly degraded with this 
approximation. Thus, the simplest option was selected, and the estimate of sideslip was set to zero. 



B-52 Transient 

When V131 and V132 separated from the starboard wing of the B-52, they experienced a strong downward 
pitch and positive roll and yaw moments due to the sway brace flow interference and down-wash and out- 
wash effects from the B-52 wing and fuselage. These dissipated quickly as the distance from the B-52 
increased; however, for VI32, the resulting high angular rate transient had to be actively controlled. 
Though VI32 control effectors could not overcome these forces, they were used at saturation limits to 
mitigate the disturbance as much as possible. 

Due to the highly nonlinear nature of this B-52 transient problem, 6-DOF simulation was used heavily to 
converge upon a viable solution. Nearly 80% of the control design effort was incurred solving this 
problem, primarily through trial and error. The solution that evolved consisted of two changes to the 
control algorithm and two associated with its initiation. These 4 changes are now presented. 
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Control Allocation 

The control allocation logic in MACH is based upon specified effector limits and preferences. Typically, 
when shared surfaces such as the body flaps are used for both elevon and aileron deflections, preference 
would be given to the elevon to satisfy the MCV (or angle-of-attack) command. Any remaining authority 
would then be available to the aileron to help satisfy the LCV (or bank angle) command. This scheme 
proved to be problematic when controlling the B-52 disturbance: All available flap motion was allocated to 
the elevon, preventing adequate roll authority. As a solution for VI32, 50% of the flap rate and 4° of flap 
position was reserved for use by the aileron when necessary. When not required by aileron, the reserve was 
made available back to the elevon. 

Figure 9 illustrates this “aileron reserve.” The diamond bounds achievable elevon (vertical) and aileron 
(horizontal) deflections given that elevon is limited by the flap range of 0 to 40° and aileron, while 
physically able to reach 20° in magnitude, is limited to 15° in software due to available aerodynamic data. 
Aileron and elevon commands inside these limits will be achieved. For commands outside these limits, 
the pitch axis has priority except at the top and bottom corners of the diamond. Pitch priority is indicated 
by horizontal lines mapping commanded points outside the diamond to achievable points on or within the 
diamond. The 4° of aileron reserve is indicated in the top and bottom corners by the vertical lines mapping 
points outside the diamond to achievable points on the diamond. Thus, Figure 9 shows how desired 
elevon and aileron commands lying outside position limits are mapped to achievable commands. 



Figure 9: Achievable Elevon-Aileron Diamond 

When VI32 control surfaces hit rate or position limits and desired LCV and NCV rates could not be 
satisfied, MACH DI and a control allocation algorithm known as SMN (ref 7) used priority weighting to 
emphasize NCV errors 5 times more than LCV errors in establishing surface commands that approximately 
satisfied CV commands, i.e., “zero sideslip” took priority over “wings level” during the B-52 transient. 

Delayed Integrator Activation 

The desired dynamics used classical P+I compensation for frequency shaping and bandwidth selection. The 
NCV integrator charged up during the B-52 transient despite the anti-windup logic and in some instances 
caused an undesirable negative roll overshoot, i.e., an “over-reaction” to the initial positive roll transient. 
This was remedied by removing integral action in the NCV channel for the first 3 seconds of flight. When 
the NCV integrator was activated at 3 seconds, the transition was smooth with no transient. 

Control Law Activation Time 

The time at which the FCS was activated after release was a design parameter used to manage the B-52 
transient. Though the vehicle airframe was stable, it was determined that early activation of the control law 
was best. DFRC analysis confirmed there was no recontact issue, so MACH was activated at the earliest 
possible time of 0.32 seconds after release. 
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Initial Elevon Position 

The transient negative pitch rate caused the elevon to initially move upward, pulling the nose back up. The 
downward pitching moment quickly disappeared, and the elevon, riding the rate limit, could react quickly 
enough to avoid an overshoot in angle-of-attack, often above the 20° “comfort zone” limit where rudder 
stall was feared. Setting the initial position at a lower (relative to previous drop tests) deflection of 25° 
reduced this a overshoot. Moving the elevon near the middle of its range also increased available aileron 
deflection. Special MACH initialization software was developed to load the MCV integral state and 
produce an equal elevon command, thus avoiding a startup command error transient. 


Robustness to Aerodynamic Uncertainties 

MACH architecture enables frequency loop-shaping in the desired dynamics block to provide robust 
stability in the presence of high-frequency plant uncertainties (ref. 4). However, bandwidth selection alone 
provided insufficient robustness, i.e. stability margins, over the large range of VI32 aerodynamic 
uncertainties. A new tack to improve robustness involved the selection of the aerodynamic model used in 
the OBAC. Instead of a nominal aerodynamic model, a particular aerodynamic uncertainty set was selected 
to describe the dynamics in the OBAC. The result was increased robust stability with a small expense to 
nominal performance. The selection procedure is described below for the linear multivariable case and 
demonstrated with a first order, SISO example. 

Multivariable Motivation and Solution 

Figure 10 is a block diagram of the innermost dynamic inversion loops. The problem is to achieve robust 
stability with respect to particular models which are spread around the set of uncertainty models. The 
eigenvalues of the closed loop in Figure 10 will be used for model selection. The subscript i indexes the 
particular state-space model of the aircraft and j indexes the model used in the control law OBAC. 


Multiplicative 

Inverse 



Figure 10: Block Diagram of Closed Dynamic Inversion Loops 
In the ideal case where there is no model mismatch (A;= Aj, Bj= Bj, C\ = Q), an analytical derivation of 

• des 

the closed loop transfer function from ^ to y shows pole/zero cancellations which result in a pure 

integrator. Now when there is model mismatch, the poles and zeros do not cancel, and some of the 
remaining poles may be unstable. An instability may be fast enough that it will not be robustly stabilized 
by the other, outer control loops supplied by MACH. 

The solution presented here is to pick the control law model that best stabilizes—i.e., has the most 
negative real part of the eigenvalues—all aircraft models—measured by the most unstable eigenvalue. In 
general, this involves solving for the eigenvalues of i*j closed loop systems. For any (ij) pair, the most 
unstable eigenvalue is given as: 

A, =maxR e{ei&A, -B,(CftTC f Aj]} 

Then the rule is to choose the control law model (index j) corresponding to 

A = min max \ 

j i 

Note that this solution assumes perfect sensors and actuators, and full state feedback. 
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SISO Example 

Consider a first order dynamic model, X — ctx + bu 5 where -3 < a < -1 and 1 <b< 3. The parameter 
space and five specific models of interest are shown in Figure 11. This is a typical scenario in which the 
the comers of the parameter space are specified and the nominal is assumed to be at the middle. 



Figure 11: Parameter Space for First Order SISO Example 

Computing closed-loop eigenvalues for all combinations of plant and control yields the table in Figure 
12. Note that the figure also shows the steps for model selection. First, for each control law, close the loop 
with all possible aircraft models and note the most unstable eigenvalue. Second, note the most stable of 
the result of step one. Finally, pick the control law model associated with the result of step two. 
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Figure 12: Model Selection for First Order SISO Example 


For this simple example, the best option is to choose point 4 which is something other than the nominal 
for the control law model. 


X-38 V132 

The driving requirements for VI32 were in the lateral-directional axes. There are nine aerodynamic 
derivatives of interest in the parameter space: rolling and yawing moment and side force coefficient 
derivatives with respect to sideslip angle, aileron and rudder. 167 sets of model uncertainty representing a 
variety of sizes and combinations of parameter uncertainty were considered. As in the simple SISO example 
above, the nominal aerodynamic model was not chosen, as it did not provide the most robust stability 
across the dispersion space. The particular uncertainty combination chosen was used to generate the OBAC. 
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CERTIFICATION PROCESS 


VI32 MACH FCS certification was the final pre-flight verification that the software met stability and 
performance requirements. Linear analysis verified gain and phase stability margins, and nonlinear, 6-DOF 
simulation verified performance and stable oscillations. 


Nonlinear Certification 

A high-fidelity, 6-DOF simulation of X-38 vehicle dynamics with closed loop GN&C systems was used 
to look for VI32 FCS instabilities and performance violations in a variety of dispersed stress cases. The X- 
38 simulation was derived from the Shuttle version of the Spacecraft Engineering Simulator (SES), a 
mature engineering tool long used for system development and post flight trajectory reconstruction. The 
SES includes high-fidelity models of the environment (aerodynamics, gravity, winds, and atmosphere), 
flight hardware (actuators, sensors, control surfaces) and flight software (GN&C executive, FCS, etc.). In 
addition to all-software simulations, the SES was hooked up to VI32 for real-time, closed-loop testing of 
hardware and software. For nonlinear certification, the SES ran in batch mode, varying deterministic 
“worst-case” combinations of aerodynamic, sensor, and initial condition parameters. 

The VI32 MACH nonlinear certification included a series of 18 test cases and 2000 simulated drops the 
SES. These SES runs verified that VI32 would fly well in the given flight envelope, and examined system 
behavior beyond the expected flight envelope (Table 3). 


Parameter 

Variation 

Alpha (a) 

8°, 12° (nominal), 16° 

Aerodynamics 

34 worst case uncertainty sets 

B-52 interference effects 

3 -a B-52 aerodynamic interference 

Gusts, turbulence 

20 fps gusts, moderate turbulence 

Mass properties 

Variations of X cu , Y ctt . Z cli . I xx . I vv . Lz 

Winds 

99% Edwards Port, Tail. Side, Shear 

System failures 

1 surface failure, FADS failure. 

Initial drop state 

Dispersions on initial position, velocity, and heading. 

PTI 

2 sets of aileron, rudder doublets. 


Table 3: Parameter Variations for Nonlinear Certification 


For the planned flight trajectory at a = 12°, the system met performance requirements and was robustly 
stable. However, for many lower a = 8° trajectory cases, the system exhibited unstable behavior, often 
losing roll control while maintaining pitch control. These “stability rolls” were due largely to reversal in 
VI32 aileron control authority at a < 10°. Steps were taken to avoid such a low a in the event of a FADS 
failure, and software was added to start the drogue chute deployment sequence early if necessary. 


Linear Certification 

Though DI does not guarantee robust stability and performance, the MACH algorithm can be linearized to 
produce traditional stability margins and linear time responses at steady-state operating points [6]. These 
were relied upon heavily to evaluate design changes and measure closed-loop robustness. In fact, 
certification for flight mandated the closed-loop system meet SISO stability margin requirements for 
selected “worst-case” aerodynamic uncertainty sets. In addition to stability margins, a more thorough 
multi-input/multi-output (MIMO) approach using structured singular value (|i) techniques was utilized to 
determine stability and performance robustness over all possible combinations of aerodynamic 
perturbations. This section summarizes the results of these analyses. 
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Stability analyses were performed at dispersed flight conditions generated with 33 selected aerodynamic 
uncertainty sets [ACl b , ACldr, ACl da , ACn b , ACn dr , ACn da , ACy b , ACy dr , ACy da ,ACm 0 ] representing 5-g 
statistics along the nominal mission profile. Trajectory “snap shots” were taken at 10, 25 and 40 seconds 
after B-52 launch where steady-state conditions from the 6-DOF simulation were used to generate linear 
models. Controller models were built up from linearized OBAC models, created from actual flight code at 
the sensed flight conditions. Linear plant models included aerodynamic dispersions, sensor and actuator 
dynamics as well as avionics transport lags. Data characterizing the VI32 hardware was obtained through 
vendor specifications and vehicle end-to-end tests [ref Jay’s web site, even though no one can see it?]. 

Table 4 summarizes the VI32 linear model characteristics. Single loops were broken in 3 actuator (aileron, 
elevon, rudder) and 8 sensor (p, q, r, V, a, <|>, 0, n y ) paths to compute open-loop gain and phase margins. 


V132 Hardware Element 

Linear Model Definition 

Accelerometer 

I st order: co n = 44 rad/sec 

Rate Gyro 

1 st order: co„ = 66 rad/sec 

Actuator 

Two 2 nd -order: co n = 50 rad/sec, £ = 0.7 

0 ) n = 26 rad/sec, £ = 0.7 

Transport Lag 

40 ms 


Table 4: VI32 Hardware Models 


Results of the SISO linear analyses for the nominal 12 degree angle-of-attack profile are summarized in 
Figure 13 [ref Jay’s presentation]. Even with 5-g dispersions, the MACH controller was shown to meet 3- 
G stability margin requirements except in one dispersed case in yaw-rate feedback. 

A MIMO method for applying all 9 aerodynamic uncertainties simultaneously using pi-analysis was 
developed to determine worst-case performance and gain and phase margins of the closed-loop system [9]. 
With this technique, fixed-size uncertainties were used to calculate the worst-case H* gain of the 
performance transfer matrix. This same worst-case analysis method was used to calculate a conservative 
measure of the minimum combined gain and phase margins of each input/output. In doing this, the worst- 
case perturbation set for each channel was automatically determined. The results of these analyses using 
similar 5-g dispersions are shown in Tables 5 and 6. 

[Tables 5 & 6: show Balas results from AIAA paper, Tables 1 and 2] 
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Linear Phase Margins (deg) Linear Gain Margins (dB) 


X38 FF3 MACH vl.4 Linear Stability Margin Survey 
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Figure 13: VI32 MACH Linear Stability Margins 
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FLIGHT TEST RESULTS 


VI32 FF3, the first flight test of MACH, successfully occurred on March 30, 2000, at DFRC. VI32 was 
dropped from the B-52 bomber at an altitude of 38,828 ft, a dynamic pressure of 125 psf and M = 0.6. The 
FCS was engaged at 0.32 seconds after B-52 release and terminated at drogue chute reposition 
approximately 50 seconds later. The 50 seconds of MACH controlled flight included 44 seconds of free 
flight and 6 seconds under the drogue chute. During the free flight, the pre-programmed, open-loop 
guidance commanded angle-of-attack through a profile of 12°, 15° and 11° while bank angle was 
commanded to zero. Three PTI test objectives were carried out, applying a double sweep of the rudders and 
ailerons at different angles-of-attack, then performing a bank PTI to study roll performance. The PTI data 
was used to better characterize the aerodynamics of the surfaces and vehicle. Atmospheric conditions were 
light-to-moderate turbulence with a 45 knot cross wind (starboard side) relative to the velocity at drop 
altitude. According to balloon data, the vehicle encountered a head/tail wind shear of about 40 knots 
midway through the flight during the angle-of-attack maneuver. Flight reconstruction showed that the 
vehicle flew within its 3 -a dispersion envelope and MACH proved to be a DI FCS capable of 
autonomously controlling an atmospheric lifting body. 



flight time (sec) 

Figure 14: VI32 FF3 Vehicle Attitude 
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Figure 15: VI32 FF3 Surface Positions 
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CONCLUSIONS 


VI32 presented many challenges for FCS design. Besides the inherently coupled dynamics and reduced 
controllability and stability of a subsonic lifting body, a primary design driver was the aerodynamic 
transient encountered when dropping away from the B-52. Proper design of the MACH FCS helped make 
the maximum roll and sideslip angles due to B-52 interference in FF3 the lowest of all VI32 free flights, 
despite FF3 being the fastest and highest of the three VI32 flight tests. The MACH FCS design effort was 
able to meet robust stability requirements with a rapidly changing aerodynamic database—partly due to the 
“automatic gain scheduling” provided by the OBAC—that included relatively large uncertainties. 

MACH successfully flew as an autonomous FCS in VI32 FF3, the first flight test of this Honeywell 
implementation of the DI design technique. While MACH may have greater computational requirements 
than traditional, linear FCS design methods, the least-squares simplification of the aerodynamic database 
for the OBAC and the general streamlining of MACH source code enabled it to fit well within the 
computational budget of the VI32 flight computer. Though DI is often considered primarily a high- 
performance control law design method, proper selection of outer loop gains and aerodynamic uncertainty 
set for the inner loop OBAC enabled MACH to meet all robust stability requirements. Despite being a 
nonlinear controller, MACH was linearized in order to take advantage of SISO and MIMO linear stability 
analyses. This MACH design was certified for VI32 FF3 with the same linear and nonlinear analyses 
previously used for the classical, Shuttle-derived FCS in FF1 and FF2, i.e., the certification process was 
independent of the control law algorithm. The application of MACH to VI32 advanced DI FCS 
technology, thus helping to fulfill the “technology demonstration” goal of the X-38 Project. 
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NOTATION 


a 

alpha or angle of attack 

P 

beta or angle of sideslip 

CnP 

yawing moment coefficient due to beta 

cip 

rolling moment coefficient due to beta 

ClSa 

rolling moment coefficient due to aileron 

Cl8r 

rolling moment coefficient due to rudder 

Cn8a 

yawing moment coefficient due to aileron 

Cn5r 

yawing moment coefficient due to rudder 
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